19

I am trying to debug a crashed (or hanging) app. How do I get the diagnostic files from the crash?

18

Individual crash reports are stored in ~/Library/Logs/CrashReporter but there is a system wide log collection tool called sysdiagnose.

Once you start experiencing the issue, hold down the 4 control keys and then press the period "." key. shift+control+option+command+.

After about 15 seconds, a Finder window will open with a sysdiagnose file highlighted.

Once you start experiencing the issue, hold down the "shift"+"control"+"option"+"command" keys and then press the period "." key.

This shortcut simply executes the sysdiagnose command, so if you are familiar with the terminal and want to pass in a process ID, you can get enhanced debugging information about that specific program. The key shortcut calls the tool with no arguments and captures the basic report only.

  • is there a way, to get this by command line? – Sidasa Aug 7 '12 at 21:42
  • 1
    ~/Library/Logs/CrashReporter does not contain .crash files. Instead: /Library/Logs/DiagnosticReports and ~/Library/Logs/DiagnosticReports – Graham Perrin Feb 14 '13 at 19:31
  • The key chord for sysdiagnose will work only if the stackshot daemon runs. In my answer, the launchctl command will start the daemon. – Graham Perrin Apr 6 '13 at 17:16
  • is the sysdiagnose command also available in OS 10.6? I don't find a man page and which sysdiagnose returns nothing in OS 10.6.8, or do I have to install it explicitely? – MostlyHarmless Apr 17 '13 at 22:56
  • 1
    @Martin my answer is edited to address your question. – Graham Perrin Jun 17 '13 at 11:12
16

Apple sysdiagnose

This shell script(on 10.8 and lower) and executable program by the same name on 10.9:

  • gathers system-wide diagnostic information
  • is integral to OS X Lion and greater
  • is not available as a separate download
  • is not open source (I have asked Apple to make it so).

Preparing for the keyboard-only approach to sysdiagnose

In Terminal, run the following command.

sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.stackshot.plist
  • if prompted for a password, enter your admin password for the operating system
  • that's a one-off, no need to repeat the command.

Take a written note of the following key chord, you'll need it later:

Control-Option-Command-Shift-.

Diagnosis by the system

When an issue occurs:

  1. use the key chord
  2. for at least ten seconds, touch nothing
  3. allow maybe five or ten minutes for all parts of the sysdiagnose routine to complete – simply wait as long as you can (there'll be no on-screen indication of progress)
  4. Finder should open a window to the end result.

Exceptionally

In rare cases, an issue may prevent sysdiagnose from completing (I have made improvement suggestions to Apple). If this happens – if you're sure that you have waited long enough – it may be sensible to restart the Mac. Then:

  1. in Finder, go to /private/var/tmp
  2. seek a file or folder with a name beginning sysdiagnose_
  3. if that file or folder exists, move it to a convenient place – your desktop, maybe.

Hints

Without the key chord, you can run sysdiagnose from the command line (see below, Apple manual page). But it's often more useful, or necessary, to use the chord – so be prepared.

Whilst I don't encourage carelessness, you can be a little careless with Control-Option-Command-Shift-. … if you struggle to avoid the fn key on your laptop, don't worry; including it by accident should not prevent the run of sysdiagnose.


Human analysis of diagnosis by the system

Hint: someone might like to ask a separate question about analysing the results of sysdiagnose – a more generalised answer could be useful.

If sysdiagnose_… from the /tmp area is a file

Presence of a sysdiagnose_….tar.gz file indicates that all parts of the sysdiagnose routine completed, and that the results were archived. If you wish, open the archive – its contents will appear as a folder.

If sysdiagnose_… from the /tmp area is a folder

Presence of a sysdiagnose_… folder (not a .tar.gz file) indicates that either:

  • the routine was interrupted before completion; or
  • some part of the routine could not complete.

Within the archive/folder

Some files are human-readable and may help to troubleshoot an issue.

Other files are more developer-oriented.

Related:

For an incomplete run of sysdiagnose it may be useful to focus some attention on files that are abnormally empty …


Technical and other notes

stackshot(1) OS X Manual Page

sysdiagnose(1) OS X Manual Page

Some of what's above is a more generic edition of an accepted answer that appears elsewhere.


Diagnostic and usage information, other files of interest

Be guided by the log list in Console:

A screenshot of the sidebar of Console

Expect to find files at the following paths:

  • ~/Library/Logs/DiagnosticReports
  • /Library/Logs/DiagnosticReports
  • ~/Library/Logs
  • /Library/Logs
  • /private/var/log
  • 1
    → Graham: this is a + day: something to learn! I think this kind of tool would benefit all sysadmins input if it was open source. – dan Aug 4 '13 at 13:42
0

Console

To find existing diagnostic or crash files, open Console app and find the files in User Reports (located at ~/Library/Logs/DiagnosticReports) in or System Reports (located at /Library/Logs/DiagnosticReports) sections. See: Where can I find my crash logs?

sysdiagnose

As per official sysdiagnose instructions for macOS, you can trigger a sysdiagnose either by:

Note: To access above link, you need to log-in to Developer Apple site first.

  • Briefly press the following keys simultaneously:

    Command-Option-Shift-Control-Period (.)

    and wait. The sysdiagnose process can take 10 minutes to complete. Once finished, Finder should automatically appear showing the generated file in /private/var/tmp/ (e.g. sysdiagnose_2017.mm.dd_hh-mm-ss-0000_12345.tar.gz).

  • Trigger a sysdiagnose from Terminal by entering this command:

    sudo sysdiagnose
    

core dumps

To generate crash core dumps, see: How to generate core dumps on macOS?

You must log in to answer this question.

protected by bmike Nov 18 '18 at 20:27

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .